The cyberattack targeting the email hosting service utilized by Alternative für Deutschland (AfD), Germany’s leading far-right political party, resulted in the exposure of over 345,000 distinct email addresses and numerous confidential attachments.
Have I Been Pwned confirmed the scope of this security incident today, following the AfD’s official disclosure last week regarding the September attack on its hosting provider.
The party stated that "only a few email accounts were illegally copied," yet acknowledged that a substantial volume of data was compromised, leading to a significant data breach. This leaked material was subsequently uploaded to a website described by the party as "an activist website," which organizes email threads into searchable subjects.
Investigative journalist Lilith Wittmann reported, based on discussions with the cybercriminals and party sources, that the intrusion was first observed on September 9. The incident began with the compromise of a weakly secured WordPress site, allowing the perpetrators persistent access to the servers managed by the hosting provider, Alternita Dienstleistungs GmbH, leading to the exfiltration of over one terabyte of data.
Alternita Dienstleistungs has been contacted for comment, but the AfD confirmed that the owners of the affected accounts have been notified, and the attack was reported to security authorities. In an October 20 statement, the party expressed deep concern, asserting, "Such a digital attack is illegal and a criminal offense. Furthermore, it is an attack on the German party system and thus on democracy."
The AfD also voiced worry that the stolen documents’ content was apparently analyzed using a rudimentary AI, which focused on keywords rather than context. The party claims that the alleged scandals published thus far lack substantiation, a point reportedly being validated by increasing commentary on social media.
Der Spiegel reviewed the raw files and indicated that party leader Alice Weidel may have been aware of illegal donations connected to the 2017 federal elections weeks prior to her public statement on the matter.
The party maintains that the AI summaries derived from the emails should not be trusted, though it has not specifically addressed the accuracy of the raw email files available via torrent.
This event highlights vulnerabilities within digital infrastructure, where compromised hosting environments can lead to extensive data exposure, impacting political entities and raising questions about digital security protocols across various market participants.
